Attachment 576573 Details for Bug 811334 – Fixed version of our custom policy

Fixed version of our custom policy

systemd_killer.te (text/plain), 1.29 KB, created by Jonathan Abbey on 2012-04-10 19:44:09 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jonathan Abbey

Created: 2012-04-10 19:44:09 UTC

Size: 1.29 KB

patch

obsolete

>
>module systemd_killer 3.0;
>
>require {
>	type unconfined_t;
>	type unconfined_java_t;
>	type chrome_sandbox_t;
>	type sshd_t;
>	type xauth_t;
>	type unconfined_dbusd_t;
>	type systemd_logind_t;
>	type chrome_sandbox_nacl_t;
>	type unconfined_execmem_t;
>	class process { signal signull sigkill };
>	class capability kill;
>	attribute application_domain_type;
>	attribute unpriv_userdomain;
>}
>
>#============= systemd_logind_t ==============
>
>allow systemd_logind_t self:capability kill;
>allow systemd_logind_t chrome_sandbox_nacl_t:process { signal signull sigkill };
>allow systemd_logind_t chrome_sandbox_t:process { signal signull sigkill };
>allow systemd_logind_t sshd_t:process {signal signull sigkill };
>allow systemd_logind_t unconfined_dbusd_t:process { signal sigkill signull };
>allow systemd_logind_t unconfined_execmem_t:process { signal signull sigkill };
>allow systemd_logind_t unconfined_java_t:process { signal signull sigkill };
>allow systemd_logind_t unconfined_t:process { signal signull sigkill };
>allow systemd_logind_t xauth_t:process { signal signull sigkill };
>
># and do attribute magic that will let us systemd_logind_t kill the
># unconfined stuff.
>
>allow systemd_logind_t application_domain_type:process { signal signull sigkill };
>allow systemd_logind_t unpriv_userdomain:process { signal signull sigkill };

Actions: View

Attachments on bug 811334: 576539 | 576542 | 576561 | 576573